CodeSampleX

Sample

ws 8.18.0: Prove that WebSocket.Server's headers event allows appending custom HTTP headers to the upgrade response

Verified sample for npm ws 8.18.0: Prove that WebSocket.Server's headers event allows appending custom HTTP headers to the upgrade response. The contract ran…

sha256:5f1c789102dfbea125a68fc2917dbc83d9878ae5092f3b71c085dd77db5e2e41

This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people. MIT-0

Execution evidence

The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.

Evidence basis
Signed contract pass
Verification receipts
3
Signing keys that built it
3
Declared environment node linux x64 node node npm

Verification-run environments

Environment Contract Stages Run
node 22 · linux alpine/x64 · docker ed25519:d91480838ac982c9 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · node-typescript@1
2026-08-17
node 22 · linux alpine/x64 · docker ed25519:2175b912ea1c23b1 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · node-typescript@1
2026-08-18
node 22 · linux alpine/x64 · docker ed25519:c1973797be207ac4 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · node-typescript@1node:22-alpine@sha256:c610fcdfb1d5…
2026-09-08

Case

HOW
Goal
Prove that WebSocket.Server's headers event allows appending custom HTTP headers to the upgrade response
Packages
Symbols
  • WebSocketServer
Environment
node
Created
2026-08-17T11:08:00Z

Contract

  1. The headers array passed to the 'headers' event listener can be mutated to send custom headers back to the client during the WebSocket handshake.
  2. A client can read these custom headers during its 'upgrade' event.

Files

  • NOTES.md
  • csx.json
  • package-lock.json
  • package.json
  • test/contract.mjs
  • test/scratch.mjs

Download the source artifact (tar.gz)

Source

NOTES.md
The `search_known_solution` query for `WebSocket.Server` and its `headers` event returned no matches.

This sample pins `ws` at version 8.18.0, the current stable major branch.
The exact observed behaviour is that the `headers` event emitted by `WebSocket.Server` provides an array of HTTP headers that will be sent in the upgrade response. Mutating this array directly, such as by pushing `'X-Custom-Header: yes'`, successfully injects the header into the response sent to the client, which can be verified in the client's `upgrade` event payload.
csx.json
{"case":{"caseId":"case:sha256:9228cc375b361966cf13821a0e25d65c73b9c62c4499d0721ecd335b16b5cb6c","contract":["The headers array passed to the 'headers' event listener can be mutated to send custom headers back to the client during the WebSocket handshake.","A client can read these custom headers during its 'upgrade' event."],"goal":"Prove that WebSocket.Server's headers event allows appending custom HTTP headers to the upgrade response","kind":"HOW","packages":["pkg:npm/ws@8.18.0"],"schemaVersion":1,"symbols":["WebSocketServer"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","ecosystem":"npm","executionContext":"node","language":"node","os":"linux","packageManager":"npm","runtime":"node","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/ws@8.18.0"],"schemaVersion":1,"symbols":["WebSocketServer"],"verifierAdapter":"node-typescript@1"}
package-lock.json
{
  "name": "npm-ws-version-depth",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "npm-ws-version-depth",
      "version": "1.0.0",
      "license": "ISC",
      "dependencies": {
        "ws": "8.18.0"
      }
    },
    "node_modules/ws": {
      "version": "8.18.0",
      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.0.tgz",
      "integrity": "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==",
      "license": "MIT",
      "engines": {
        "node": ">=10.0.0"
      },
      "peerDependencies": {
        "bufferutil": "^4.0.1",
        "utf-8-validate": ">=5.0.2"
      },
      "peerDependenciesMeta": {
        "bufferutil": {
          "optional": true
        },
        "utf-8-validate": {
          "optional": true
        }
      }
    }
  }
}
package.json
{
  "name": "npm-ws-version-depth",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "dependencies": {
    "ws": "8.18.0"
  },
  "description": "",
  "main": "index.js",
  "directories": {
    "test": "test"
  },
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC"
}
test/contract.mjs
import { WebSocketServer, WebSocket } from 'ws';
import assert from 'node:assert';

const wss = new WebSocketServer({ port: 0 });

wss.on('headers', (headers, request) => {
  headers.push('X-Custom-Header: yes');
});

wss.on('listening', () => {
  const port = wss.address().port;
  const ws = new WebSocket(`ws://127.0.0.1:${port}`);
  
  ws.on('upgrade', (res) => {
    try {
      assert.strictEqual(res.headers['x-custom-header'], 'yes');
      process.exit(0);
    } catch (err) {
      console.error(err);
      process.exit(1);
    }
  });
});
test/scratch.mjs
import { WebSocketServer, WebSocket } from 'ws';
import assert from 'node:assert';

const wss = new WebSocketServer({ port: 0 });
wss.on('headers', (headers, request) => {
  headers.push('X-Custom-Header: yes');
});

wss.on('listening', () => {
  const port = wss.address().port;
  const ws = new WebSocket(`ws://127.0.0.1:${port}`);
  
  ws.on('upgrade', (res) => {
    try {
      assert.strictEqual(res.headers['x-custom-header'], 'yes');
      console.log('Contract passed');
      ws.close();
      wss.close();
    } catch (err) {
      console.error(err);
      process.exit(1);
    }
  });
});

Origin Seeder

csx-seed